<?php
/**
 * Optional Cloudflare Turnstile check on the first save. Off unless both keys
 * are set (mapp_turnstile_site_key, mapp_turnstile_secret).
 *
 * @package mortgage_application
 */

namespace Mapp\Rest;

defined( 'ABSPATH' ) || exit;

class Turnstile {

	/** @return bool */
	public static function enabled() {
		return '' !== (string) get_option( 'mapp_turnstile_site_key', '' ) && '' !== (string) get_option( 'mapp_turnstile_secret', '' );
	}

	/**
	 * @param string $token Widget token.
	 * @param string $ip    Client IP.
	 * @return true|\WP_Error
	 */
	public static function verify( $token, $ip ) {
		if ( ! self::enabled() ) {
			return true;
		}
		$response = wp_remote_post(
			'https://challenges.cloudflare.com/turnstile/v0/siteverify',
			array(
				'timeout' => 10,
				'body'    => array(
					'secret'   => (string) get_option( 'mapp_turnstile_secret' ),
					'response' => $token,
					'remoteip' => $ip,
				),
			)
		);
		if ( is_wp_error( $response ) ) {
			// Fail open on Cloudflare outages; rate limits still apply.
			return true;
		}
		$body = json_decode( wp_remote_retrieve_body( $response ), true );
		if ( ! empty( $body['success'] ) ) {
			return true;
		}
		return new \WP_Error( 'mapp_bot_check', __( 'Please complete the security check and try again.', '1003-mortgage-application' ), array( 'status' => 400 ) );
	}
}